Use of Weak Hash

Overview asu is an An image on demand server for OpenWrt based distributions Affected versions of this package are vulnerable to Use of Weak Hash which allows the ASU server to be polluted with malicious firmware images. Due to the low entropy employed when only 12 characters are used from the...

CVE-2024-54143 openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious...

Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

GHSA-VXCF-C7MX-PG53 Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

PT-2024-40490 · Pypi · Pyo3

Name of the Vulnerable Software and Affected Versions: PyO3 versions 0.23.0 through 0.23.2 Description: The issue arises from a regression in the PYO3 CONFIG FILE environment variable, which is used to configure builds. This regression causes PyO3 to fail to reconfigure and recompile when the...

RUSTSEC-2024-0409 Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

CVE-2018-9429

In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

GHSA-9R9M-FFP6-9X4V vue-i18n has cross-site scripting vulnerability with prototype pollution

Vulnerability type XSS Description vue-i18n can be passed locale messages to createI18n or useI18n. we can then translate them using t and $t. vue-i18n has its own syntax for local messages, and uses a message compiler to generate AST. In order to maximize the performance of the translation...

CVE-2024-53751

Cross-Site Request Forgery CSRF vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through = 1.0.23...

CVE-2024-53751

Cross-Site Request Forgery CSRF vulnerability in Abdul Hakeem Build App Online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through 1.0.22...

CVE-2024-53751

CVE-2024-53751 is a CSRF vulnerability in the WordPress plugin Build App Online, affecting versions up to 1.0.22. The CVE entries from multiple sources corroborate a CSRF issue in Build App Online with affected versions listed as

PT-2024-35861 · Unknown · Abdul Hakeem Build App Online

Name of the Vulnerable Software and Affected Versions: Abdul Hakeem Build App Online versions 1.0.22 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For Abdul Hakeem Build App Online versions 1.0.22 a...

WordPress plugin Build App Online 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-54124

In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen...

PT-2024-36056 · Click Studios · Passwordstate

Name of the Vulnerable Software and Affected Versions: Click Studios Passwordstate versions prior to build 9920 Description: The issue concerns a potential permission escalation on the edit folder screen. Recommendations: For versions prior to build 9920, update to a version that includes the fix...

WordPress Build App Online plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin Build App Online versions = 1.0.23...

[SECURITY] Fedora 40 Update: mingw-libsoup-2.74.3-8.fc40

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...

MAL-2024-11087 Malicious code in seller-webchat-build-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b3dfd5d6ff1c62c4de5dec773047aa8b80fe5ccaa84cc4e2ab8d35b7eedebe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Keycloak Build Process Exposes Sensitive Data

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in...

GHSA-V7GV-XPGF-6395 Keycloak Build Process Exposes Sensitive Data

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in...